Anyone else doing computer forensics or ediscovery? | Hacker News Reader

Anyone else doing computer forensics or ediscovery?

2 pointskovar8 comments

I'm working on a startup in the ediscovery space while continuing to do computer forensics to keep my hand in and generate revenue.

Many advances in technology (CUDA, for example) aren't finding their way into ediscovery and forensics products. There are some interesting opportunities....

View on HN

I work on the signal side of discovery. What do you have in mind?

One question that keeps coming to mind for me - how could you take a forensically sound image of a hard drive and prepare it for processing by a wide variety of tools in a non-serial manner? We spend a lot of our time searching through hard drive images... The current state of the art for indexing doesn't address the need to look for viruses, rootkits, keywords, CP, stego, etc etc at different stages of the investigation.

Good ole stego. Manual discovery is 99% of the fun!

Manual discovery is fun, 'til you have to sift through 1TB of data looking for it, and hidden TC containers, and rootkits, and and and and... Gets tedious, and inaccurate, quickly!

True. I've used VM's, kind of like ant farm to run images through a bunch of tests and see what happens. Most of it was hacked together. It would be interesting to see what kind stuff you could do with Cluster Computing when it comes to pulling apart everything.

I've had to do static analysis of memory images paired up with FPGA's for certain types of hardware. Yeah...It drains the life out of you.

Looking to put something together? I deal with hardware most of the time. I'm trying to get out of that world and into building applications.

Very much looking to put something together. I currently have one startup effort in the ediscovery space that I am working on, but I have cycles available to explore other options, and the desire to do so.

I'm on the lookout for interesting projects to hack-on and forensics would feel like home. If your still looking at this thread mail me at Bcounsell1 () Gm/ail <> com.

Reply on news.ycombinator.com